Elsewhere

Past few days I’ve been writing this PowerShell script to set up an Azure lab environment automatically. In the time that I spent writing this script I am sure I could have set up numerous labs by hand, so it’s probably a waste of time! It’s also been a waste of time in the sense that instead of actually doing stuff in this lab I have spent that time scripting. I had to scale back a lot of what I originally set out to do because I realized they are not practical and I was aiming for too much. I have a tendency to jump into what I want to do rather than take a moment to plan out I want, how the interfaces will be etc, so that’s led to more waste of time as I coded something, realized it won’t work, then had to backtrack or split things up etc.

The script is at GitHub. It’s not fully tested as of date as I am still working on it. I don’t think I’ll be making too much changes to it except wrap it up so it works somewhat. I really don’t want to spend too much time down this road. (And if you check out the script be aware it’s not very complex and “neat” either. If I had more time I would have made the interfaces better for one).

Two cool things the script does though:

You define your network via an XML file. And if this XML file mentions gateways, it will automatically create and turn them on. My use case here was that I wanted to create a bunch of VNets in Azure and hook them up – thanks to this script I could get that done in one step. That’s probably an edge case, so I don’t know how the script will work in real life scenarios involving gateways.

I wanted to set up a domain easily. For this I do some behind the scenes work like automatically get the Azure VM certificates, add them to the local store, connect via WMI, and install the AD DS role and create a domain. That’s pretty cool! It’s not fully tested yet as initially I was thinking of creating all VMs in one fell swoop, but yesterday I decided to split this up and create per VM. So I have this JSON file now that contains VM definitions (name, IP address, role, etc) and based on this the VM is created and if it has a role I am aware of I can set it up (currently only DC+DNS is supported).

Some links of reference to future me. I had thought of writing blog posts on these topics but these links cover them all much better:

Point-to-Site VPNs are when you create a VPN from your local computer to the Azure VNet. The script above doesn’t support this yet. This is a feature I am interested in, so once I have some free time I hope to add this to the script.

A good blog post on the same topic. Lots of pictures and step by step instructions.

I am interested in Point-to-Site VPN because I don’t want to expose my VMs to the Internet. By default I disable Remote Desktop on the VMs I create and have this script which automatically creates an RDP end point and connects to the VM when needed (it doesn’t remove the end point once I disconnect, so don’t forget to do that manually). Once I get a Point-to-Site VPN up and running I can leave RDP on and simply VPN into the VNet when required.

An excellent blog post on how you can create multiple VNets in Azure and connect them via a Site-to-Site VPN. My script does this automatically if you specify multiple VPNs and gateway connections between them. This blog post was of great help learning how to do that.

Since December 2014 you can have Site-to-Site VPNs with no encryption. Don’t do that in a real life scenario, but no harm doing that for Site-to-Site VPNs between VNets in your own subscription. It will greatly improve your performance too.

VNet-to-VNet VPN requires Dynamic Gateways as does multiple Site-to-Site VPN and Point-to-Site VPN. What is a dynamic gateway? Read the above blog post. Static Routing is Policy based Route. Dynamic Routing is Route based Routing. And what are these? Read these two blog posts: [1] & [2].

Trivial stuff, but I don’t get to use PowerShell as much as I would like to so I end up forgetting elementary things that should just be second nature to me. Case in hand, I wanted to a add a line to a bunch of text files. Here’s what I came up with – just posting it here as a reference to my future selef.

For the background behind this, I use Private Internet Access for my VPN needs and since last month or so my ISP’s been blocking traffic to it. Private Internet Access offers a client that lets me connects to their servers via UDP or TCP. The UDP option began failing but the TCP option surprisingly worked. Of course I don’t want to use TCP as that’s slow and so I went to Private Internet Access’s website where they give a bunch of OpenVPN config files we can use. These are cool in the sense that some of them connect via IP (instead of server name) while others connect to well-known ports or use a well-known local port and so there’s less chance of being blocked by the ISP. In my case turned out just connecting via IP was more than enough so it looks like the ISP isn’t blocking OpenVPN UDP ports, it’s just blocking UDP traffic to these server names.

Anyhow, next step was to stop the client from prompting for an username/ password. OpenVPN has an option auth-user-pass which lets you specify a file-name where the usrname and password are on separate lines. So all I had to do was create this file and add a line such as auth-user-pass pia.txt to all the configuration files. That’s what the code snippet above does.

I use Private Internet Access for my VPN needs. They have servers in many countries and provide OpenVPN, L2TP, and PPTP access. Been using them for a year now and no complaints so far. For Android and Windows they provide apps that use OpenVPN, but for iDevices you are stuck with L2TP and PPTP and while that’s fine I prefer OpenVPN (see here and here; also worth reading this on why TCP isn’t a good idea for tunneling). Thankfully iOS has an OpenVPN client so this is something one can setup manually.

Private Internet Access provides a zip file containing all the certificates and config files for OpenVPN. You can’t use these config files directly in the client though. Will have to use iTunes and copy over the files to the OpenVPN app (with a modification to the config files which I’ll come to in a minute). Or you can make two changes to these config files (one of which you have to make even in the iTunes case) and skip iTunes. That’s what I am going to do here. I avoid iTunes if I can (not coz I hate it but generally, I don’t like to be tied to it).

The zip file provided by Private Internet Access contain files with an ovpn extension – which are the configuration files for their server at each location – as well as a ca.crt file which is the certificate for the Private Internet Access servers. The first thing we have to do is combine this ca.crt file into each of the ovpn files. This way we don’t have to worry about how to have both files in the same location as the contents are now merged into one.

The second thing we have to do is added a line like this to each of the ovpn files:

1

setenv CLIENT_CERT0

This line tells the OpenVPN client there is no client certificate. By default the iOS OpenVPN client expects a client certificate so unless make this change to the config files the client will not let us connect.

To combine the ca.crt file into each of the config files copy paste the contents of file into each of the config files, surrounding the contents with <ca> and </ca> tags. Alternatively, you could be a geek and use something like PowerShell to automate the process. Copy paste the snippet below and run it in the folder where you extracted the zip file from Private Internet Access.

1

2

3

4

5

6

7

8

$crt=(Get-Content.\ca.crt)-join"`n"

$crt="`n$crt`n"

foreach($profileinGet-ChildItem*.ovpn){

$file=(Get-Content$profile)-join"`n"

$file=$file-replace"ca ca.crt","setenv CLIENT_CERT 0`n$crt"

$file|Out-File-Encodingutf8$profile

}

Pretty straightforward. Replace the line with the contents of the file, add an extra line.

I did this for the files from Private Internet Access and uploaded the resulting files to a zip file you can download from here.

You can download the zip file on your computer, extract the contents, and email the config files you want to an email account you have on the iDevice. Opening the config file from the email will launch OpenVPN and let you add the profile to it.

Alternatively you could visit the above link in a browser such as iCab Mobile on your iDevice. Or even in a browser such as Safari, but download and open with an app like File Explorer (or any other app really which lets you open a zip file and pass the contents to another app).